home

หน้าแรก
 Computer >> บทช่วยสอนคอมพิวเตอร์ >  >> ระบบเครือข่าย >> ความปลอดภัยเครือข่าย

เครื่องมือที่ Network Security Analyst ต้องมี (Essential Tools)

เครื่องมือหลักสำหรับ Network Security Analyst

1. Network Traffic Analysis & Packet Capture

  • Wireshark: มาตรฐานอุตสาหกรรม Deep Packet Inspection, Protocol Analysis, Troubleshooting
  • Zeek (Bro): Network Security Monitor, สร้าง Log ระดับ High-level (Conn, DNS, HTTP, SSL, SSH)
  • tcpdump / tshark: CLI Packet Capture บน Server/Linux
  • NetworkMiner: Passive Network Forensics (Extract files, Certs, Credentials จาก PCAP)

2. Vulnerability Scanning & Assessment

  • Nessus (Tenable): Vulnerability Scanner #1 ครอบคลุม CVE, Compliance, Config Audit
  • OpenVAS / Greenbone: Open Source Alternative
  • Nmap + NSE: Port Scan, Service Detection, Vuln Scripts
  • Qualys / Rapid7 InsightVM: Cloud-based VM Platform

3. Intrusion Detection / Prevention (IDS/IPS)

  • Snort / Suricata: Rule-based NIDS/NIPS (Community Rules + Custom Rules)
  • Zeek: Behavioral Analysis, Anomaly Detection
  • Commercial: Cisco FirePOWER, Palo Alto, FortiGate IPS, Trend Micro TippingPoint

4. SIEM & Log Analysis

  • Splunk: Enterprise SIEM Leader (SPL Query, Correlation, Dashboard)
  • Elastic Stack (ELK): Open Source (Elasticsearch, Logstash, Kibana, Beats)
  • Microsoft Sentinel: Cloud-native SIEM + SOAR
  • QRadar (IBM), LogRhythm, FortiSIEM, Graylog

5. Endpoint Detection & Response (EDR/XDR)

  • CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Cortex XDR
  • Visibility: Process Tree, Network Connections, File Mods, Registry, MITRE ATT&CK Mapping

6. Threat Intelligence & Hunting

  • MISP / OpenCTI: Threat Intel Platform (IOC Sharing, STIX/TAXII)
  • VirusTotal, Hybrid Analysis, ANY.RUN: Malware Sandbox
  • AlienVault OTX, IBM X-Force, AbuseIPDB: Reputation Feeds
  • MITRE ATT&CK Navigator: Mapping Techniques

7. Penetration Testing / Red Team Tools (Authorized Only)

  • Metasploit Framework: Exploit Development, Post-Exploitation
  • Cobalt Strike / Brute Ratel C4: C2 Framework (Red Team)
  • BloodHound / SharpHound: AD Attack Path Analysis
  • Impacket / CrackMapExec: Lateral Movement, Credential Dumping
  • Nmap, Masscan, ZMap: Discovery

8. Cloud Security Tools

  • CloudSploit / Prowler / ScoutSuite: Cloud Config Audit (AWS, Azure, GCP)
  • Wiz, Orca, Lacework: CNAPP (Cloud-Native Application Protection Platform)
  • Falco / Sysdig: Runtime Security (Container/K8s)

9. Automation & SOAR

  • Palo Alto Cortex XSOAR, Splunk SOAR, FortiSOAR, Tines, Cortex XSIAM
  • Playbook: Auto-block IP, Enrich Alert, Create Ticket, Quarantine Host

10. Basic Defense Tools (Must-Have)

  • Next-Gen Firewall: Palo Alto, FortiGate, Check Point
  • Email Security: Proofpoint, Mimecast, Defender for Office 365
  • NAC: Cisco ISE, Aruba ClearPass
  • DLP: Symantec, Forcepoint, Microsoft Purview
  • Malwarebytes: Anti-malware เบื้องต้น (Complement AV)

ทักษะที่ต้องมี (Skills)

  • Network Protocols (TCP/IP, DNS, HTTP/HTTPS, TLS, DHCP, BGP)
  • Scripting: Python, PowerShell, Bash (Automation, Parsing Logs)
  • SQL/KQL/Splunk SPL (Query Logs)
  • MITRE ATT&CK Framework
  • Incident Response Process (NIST 800-61, SANS PICERL)
  • Certifications: GCIH, GCFA, GNFA, GCED, CISSP, CCNP Security, SC-200

Workflow ตัวอย่างของ Analyst

  1. Alert จาก SIEM/EDR/NDR
  2. Triage: False Positive? Benign? True Positive?
  3. Enrichment: Threat Intel, VirusTotal, WHOIS, Passive DNS
  4. Investigation: PCAP (Wireshark), Host Logs (EDR), Network Logs (Zeek/Firewall)
  5. Containment: Block IP, Quarantine Host, Disable Account
  6. Eradication: Remove Malware, Patch Vuln, Rotate Credentials
  7. Recovery: Restore, Verify, Monitor
  8. Lessons Learned: Update Rules, Improve Detection, Document